Wireless Networks have become more and more prevalent over the past few years as they appeal to the end users for the convenience they provide.
Security is an issue in this kind of network as the communication media used is shared. As a result, wireless networks are particularly vulnerable to attacks at the lowest levels of the communication protocols (first and second layer of the Open Systems Interconnection (OSI) model). It is indeed very easy to tap or inject traffic into such a network.
Such attacks could be used to impersonate a wireless node in order to gain a fraudulent access to the network or, even more dangerous, to arbitrary create denial of services, or ‘man in the middle’ attacks by impersonating nodes that assume a special function in the network (i.e. an access point in an 802.11 network).
Traditional security systems and technologies such are firewall or IP Security (IPSec) tunnel fail to fully address those threats since they are not designed to address security threats at lower levels of the OSI model. Other mechanisms, such as address filtering performed by the wireless equipment, are useless in this environment where impersonating a valid address is so easy to do.
It is now well understood by the industry that solutions that monitor the wireless traffic to detect the above mentioned attacks bring security benefits. This explains the increasing appearance of Intrusion Detection System (IDS) in the wireless product space.
An IDS is an entity on a network that monitors a variety of system and network resources for anomalies to detect attempts to compromise the network. An IDS generally assesses if the monitored data satisfies the network rules and heuristics, mismatches indicating an attack in progress. The IDS will then advise the network user of the attack; more sophisticated IDS may launch automatic network defense counter-measures. Monitoring can take many forms and spans from low-level inspection of the data source and destination, to inspection of data packets content and monitoring the activity on a specific host.
These security services are especially important for wireless communication, due to the ease of tapping into wireless networks. In addition, since firewalls are employed on the user side of a wireless link, a message rejected by the firewall has already consumed the wireless resources required to transmit. The wireless links are supported by Radio Frequency (RF) channels, which are a scarce resource. Accordingly, messages rejected by the firewall tend to waste bandwidth which could be allocated to other connections, can drive up user cost by increasing message transmissions, and tend to slow overall throughput because of the resources required to transmit them over the wireless link.
A specificity of wireless networks is that they require IDS-like systems specific to the lower Media Access Control (MAC) layer management element (as defined by the seven-layer OSI model) while traditional IDS systems mainly focus on the third and higher layers of the OSI model.
U.S. patent application Ser. No. 2003/0135762 (Macaulay) entitled “Wireless Network Security System” and published Jul. 17, 2003, discloses an 802.11 security system for monitoring wireless networks for detecting and locating unauthorized or threatening IEEE 802.11 devices entering a user's wireless network environment or a facility not intended to support wireless networks. The security system comprises a network appliance subsystem, a portable computing subsystem and an interface between these two subsystems. The portable computing subsystem is a manually operated device, which searches for specific devices using a directional antenna and indicates when targeted (intruder) radio signals are found, and the signal strength. The network appliance subsystem is equipped with an analyzing module that looks for IEEE 802.11-specific attack patterns using real-time analysis, and contains configurations related to alert levels and security policy configurations. However, this solution relies on traffic monitoring to detect intrusion and requires duplication of all wireless interfaces used by a respective node.
In addition, existing wireless IDSs, such as the Guard product by AirDefense™, rely on a set of network probes and a specific server appliance. However, there is no correlation or consolidation between the wireless node and the IDS system.
Joshua Wight, in an article entitled “Detecting Wireless LAN MAC Address Spoofing”, provides an in-depth analysis of the anomalies generated by tools that spoof MAC addresses. While knowledge of these anomalies enables an easier detection of the spoofed traffic generated by these tools, the analysis has some limitations. For example, it is based on anomalies generated by specific attack tools, which should not be considered as invariants. As well, most of the anomalies are present when random MAC addresses are used for attacks, which is not always the case.
In general, the prior art solutions rely only on wireless traffic monitoring in order to detect intrusions. Using such techniques, it is not possible to differentiate in a reliable way the legitimate traffic sent by a node (for instance the management or control frames) from the malicious traffic generated by an attacker node masquerading as the real node.
This inability to detect in a reliable way the occurrence of malicious traffic leaves wireless nodes susceptible to various types of attacks such as de-authentication, some Man in the Middle, denial of service, etc.